ClawHub
Back to skill

Security audit

Unified Reasoning

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad reasoning router whose advertised capabilities are not actually shipped, and its wrapper can dynamically execute an unspecified local implementation file.

Review before installing. This package does not include the reasoning engine it describes, and its wrapper is broad enough to route many normal reasoning requests while delegating to an unspecified local Python file if one exists. Prefer a version with the actual implementation included, explicit activation boundaries, and an allowlisted class/interface for any delegated code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description promises a specific, feature-rich reasoning engine with combined reasoning techniques and performance optimizations. However, the supplied code chunk does not implement any of those behaviors. It acts as a thin compatibility wrapper: it loads another file dynamically, registers a generic capability, performs simple keyword-based routing, and delegates execution to whatever class it finds in the external module. Because the actual shown behavior is materially different from the declared purpose, and the advertised capabilities are not evidenced in this code chunk, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says this skill is a 'Single entry point for all reasoning' and 'automatically selects and applies the best strategy,' which is extremely broad for a markdown skill description. It does not define clear activation boundaries, exclusions, or narrower trigger phrases, increasing the chance of unintended invocation for ordinary user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The 'Problem Characteristics Detected' table lists very common patterns such as word count and keywords like 'best,' 'option,' 'combine,' and 'verify.' These are common in everyday prompts, but the document does not clarify whether these are internal routing heuristics only or actual activation conditions, nor does it provide negative examples.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The wrapper claims to expose a reasoning skill, but it blindly instantiates the first class it finds in an external Python file and then invokes generic methods on it. This creates a capability mismatch and allows unintended or malicious code in the loaded module to be executed under a trusted skill identity, which is especially dangerous in an agent ecosystem where routing and permissions may depend on declared skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code dynamically loads and executes a local Python file using importlib without any integrity checks, sandboxing, or restriction on what top-level code runs during module import. Because exec_module() executes module code immediately, any malicious or modified unified_reasoning.py content gains execution as soon as the wrapper initializes, making this far more dangerous than a normal reasoning-only skill would imply.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · unified_wrapper.py (reported line 28)May include surrounding context.

python
# Find the main class
            for name in dir(module):
                obj = getattr(module, name)
                if isinstance(obj, type) and name != "UnifiedSkill":
                    self._original = obj()
                    break

Static analysis

No suspicious patterns detected.